The Ajax Search Lite plugin for WordPress is vulnerable to a missing authorization check in its AJAX search handler. This flaw allows any unauthenticated user to send repeated requests that return 100‑character windows of the content of protected posts. The exposure is limited to informational leakage and does not provide direct code execution or privilege escalation. This weakness is defined as Missing Authorization (CWE‑862).

The issue affects all versions of the Ajax Search Lite plugin released by wpdreams up to and including 4.13.1. WordPress sites that have installed this plugin and rely on it for live search and filtering are at risk. No specific operating system or WordPress core version is required beyond the presence of the plugin.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. The EPSS score is less than 1 %, suggesting that, while the flaw exists, the probability of exploitation in the wild is low. The flaw is not listed in the CISA KEV catalog. Attackers need only send unauthenticated AJAX requests to the ASL_Query endpoint; no authentication, user‑token, or special privileges are required prior to exploitation. The impact is confined to information confidentiality, exposing sensitive or protected post content.